In 2023, more than half of small and midsized businesses (SMBs) intend to increase their expenditures on cybersecurity — which is a positive development since six out of ten firms (61%) do not have cybersecurity staff, about half (47%) do not have incident response plans, and 40% do not conduct formal awareness training on cybersecurity. 

A study by Huntress of IT professionals at small and medium-sized businesses with 250 to 2,000 employees published on March 15 indicates that although many of the respondent organizations have deployed a range of cybersecurity products, they found that they are not the only ones. Even though they tend to ignore basic defensive measures (email security (86%), endpoint protection (79%), and network protection (73%), the US Cybersecurity and Infrastructure Security Agency (CISA) recommended recently that workers supplement their password security with two-factor or multiple-factor authentication as a means of strengthening their password security.  

As a result of their lack of preparation, understaffing, and/or under-resourcing, a majority of these companies feel unprepared or under-resourced to respond to evolving threats. Many of these businesses face difficulties obtaining cybersecurity insurance coverage and ensuring their employees are properly trained on security issues. According to Huntress' report, several midsize companies know multiple cybersecurity layers are necessary. However, there are significant gaps in the tools and planning processes used by these businesses. 

Additionally, a full third of the respondents (34%) said they are unaware of advanced threats and do not believe they could detect them. 

According to Roger Koehler, CISO at Huntress, a substantial percentage of individuals are unaware that their identities have been targeted. For these organizations to remain protected, visibility is of the utmost importance. This is because malicious actors can spend weeks or even months sitting in their networks, gaining footholds, and gathering information to perform their attacks. 

According to the Huntress study, 14% of respondents in this business segment confirmed having experienced an attack within the last year. There was also 10% of IT professionals unsure whether there had been a cyberattack during the survey period. In the United States, there are about 6 million companies between the ages of 250 and 2000 that employ 250 to 2,000 people. Those numbers add up pretty quickly. 

It was interesting to read that Huntress also found that 49% of organizations are planning to spend more money on cybersecurity in the upcoming year. This is to meet the staggering need for increased knowledge and preparedness in the cybersecurity arena. A proactive approach to cybersecurity on the part of such a large number of small and medium-sized businesses is encouraging, Koehler says, rather than simply reacting to attacks as they occur. As a result, the biggest challenge in spending that budget will be finding the right employees within the organization. 

"It seems that middle-sized businesses are not just waiting for an attack to occur and subsequently reacting to them, but are investing in preventative measures so that these attacks can be prevented before they ever take place," Koehler says. As well as having the right people on your team, midsize businesses could benefit from having the right people to deal with attacks.  It is estimated that there are 700,000 cybersecurity jobs available as of the end of last fall, which is an increase of 43% from the end of 2021. Finding cybersecurity professionals in high demand is becoming increasingly difficult with the increase in burnout and dissatisfaction among cyber professionals. 

Managed cybersecurity services will experience significant growth in the coming years, thanks to the combination of stronger budgets and a stronger market for talented cybersecurity professionals. An analysis by McKinsey published in October concluded that this is the case. Consultants for the company believe that managed security service providers will be able to capture the majority of market share, as well as security-and-operations management projects.

According to McKinsey's analysis, over the next two years, its forecasted shift of allocated security spending to internal compared to third-party services is expected to increase across all segments of the market. Whenever talent is an issue, companies will need to turn to outsourced services when it comes to achieving strong security results, as long as talent remains a challenge.